MacOS Malware

macOS malware includes viruses, trojan horses, worms and other types of malware that affect macOS, Apple's current operating system for Macintosh computers. macOS (previously Mac OS X and OS X) is said to rarely suffer malware or virus attacks, and has been considered less vulnerable than Windows. There is a frequent release of system software updates to resolve vulnerabilities. Utilities are also available to find and remove malware.

History

Early examples of macOS malware include MP3Concept (discovered 2004, a benign proof of concept for a trojan horse), Leap (discovered in 2006, also known as Oompa-Loompa) and RSPlug (discovered in 2007).

An application called MacSweeper (2009) misled users about malware threats in order to take their credit card details.

The trojan MacDefender (2011) used a similar tactic, combined with displaying popups.

In 2012, a worm known as Flashback appeared. Initially, it infected computers through fake Adobe Flash Player install prompts, but it later exploited a vulnerability in Java to install itself without user intervention. The malware forced Oracle and Apple to release bug fixes for Java to remove the vulnerability.

Bit9 and Carbon Black reported at the end of 2015 that Mac malware had been more prolific that year than ever before, including:
* Lamadai – Java vulnerability
* Appetite – Trojan horse targeting government organizations
* Coin Thief – Stole bitcoin login credentials through cracked Angry Birds applications

A trojan known as Keydnap first appeared in 2016, which placed a backdoor on victims' computers.

Adware is also a problem on the Mac, with software like Genieo, which was released in 2009, inserting ads into webpages and changing users' homepage and search engine.

Malware has also been spread on Macs through Microsoft Word macros.

MacOS, known for its robust security, has faced evolving challenges regarding malware over time. In the early years, macOS remained relatively immune compared to other operating systems due to its Unix-based architecture and lower market share. However, as its popularity grew, so did the interest of cybercriminals. In 2006, the first significant macOS malware, the Leap-A (also known as Oompa-Loompa) worm, emerged, spreading through instant messaging. Subsequent years saw sporadic instances of malware targeting Macs, including fake antivirus software like MacDefender in 2011 and the Flashback trojan in 2012, which infected hundreds of thousands of Macs by exploiting vulnerabilities in Java. These events marked a shift, prompting Apple to enhance its security measures and introduce features like Gatekeeper, XProtect, and the App Store, aiming to protect users from potential threats in the evolving landscape of macOS malware.

macOS includes built-in security features designed to protect users from various threats, including ransomware attacks. Features such as Gatekeeper, which verifies the legitimacy of downloaded applications, and FileVault, which encrypts data on the hard drive, contribute to enhancing the overall security of the system. Additionally, Apple regularly releases security updates and patches to address vulnerabilities and known exploits that ransomware may target. However, while macOS incorporates robust security measures, no system is completely immune to evolving cyber threats. Users must practice caution by regularly updating their operating system, installing software only from trusted sources, and maintaining backups of their important data to mitigate the risk of falling victim to ransomware attacks.

Ransomware

In March 2016 Apple shut down the first ransomware attack targeted against Mac users, encrypting the users' confidential information. It was known as KeRanger. After completing the encryption process, KeRanger demanded that victims pay one bitcoin (about at the time, about as of May 16, 2025,) for the user to recover their credentials.

Mitigation

Gatekeeper is a built-in security feature of macOS meant to reduce malware execution by verifiying downloaded applications before they are launched for the first time.

MacOS 12.3 introduced XProtect Remediator, a tool which regularly scans the system for known malware.

References

Malware by platform

{{malware-stub